InfoSecBulletin Cybersecurity for mankind
Chinese-speaking hackers have added Claude, Qwen, and DeepSeek to their hacking system to automate cyberattacks on governments and other targets in Asia, according to a report from the threat intelligence company Hunt.io.
Hunt.io says this operation is different from the campaign seen in July, where a Chinese-speaking operator used Claude Code and DeepSeek in attacks in four countries. The new campaign used AI models. It focused on Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education in mainland China, and businesses in Da Nang, Vietnam.
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Hunt.io found five open directories related to the campaign. They connected them using shared tools, like a SOCKS proxy endpoint found in different places. The systems had common SecFlow and GLUTTON items, shared accounts, and a direct link to the second-stage payload.
According to the researchers, a Fengtai District government environment was hit hardest, “where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.”
The attackers accessed into a government Office Automation system that was open to the internet. They did this by using a file management tool that let them upload ASPX files and find web-accessible locations.
This let the hackers use tools on the server inside the app. They later moved a 75.8MB LSASS memory dump with important login details in 37 parts.
They got the SAM and SYSTEM registry files and set up a server page, extract.aspx, that looked for Windows password data. Then they found 822 OA account records and made a new active OA account with higher permissions. The OA storage had 949 attachments that added up to about 1.28GB.
Researchers found that the recovered material had government work and admin info, some health documents, a chronic disease report with patient details, and Windows login data.
